Bell's Inequality, Random Sequence, and Quantum Key Distribution 
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The Ekert 91 quantum key distribution (QKD) protocol appears to be secure whatever devices 
legitimate users adopt for the protocol, as long as the devices give a result that violates Bell's 
inequality. However, this is not the case if they ignore non-detection events because Eve can make 
use of the detection-loophole, as Larrson showed. We show that even when legitimate users take 
into account non-detection events Eve can successfully eavesdrop if the QKD system has been 
appropriately designed by the manufacturer. A loophole utilized here is that of 'free-choice' (or 'real 
randomness'). Local QKD devices with pseudo-random sequence generator installed in them can 
apparently violate Bell's inequality. PACS: 03.65. Ud, 03.67.Dd 



Quantum key distribution (QKD) 0. HQ is one of the 
most promising protocols in quantum information pro- 
cessing 4|. Besides the Bennett-Brassard 84 QKD pro- 
tocol Q,|3|, the interesting Ekert 91 (E91) protocol 0,0 
makes use of the nonlocality of the Einstein-Podolsky- 
Rosen pairs of quantum bits (qubits) p|. 

As is well known, even local realistic models can violate 
the Bell's inequality H if two remote experimenters, 
Alice and Bob, simply do not take into account non- 
detection events in their processing of the experimental 
data. This has been termed the detection-loophole (e.g. 
H Hi an d references therein. A discussion on the se- 
curity of the Bennett-Brassard 84 protocol in connection 
with non-detection events has recently been given Q.). 

An issue in QKD is whether legitimate users (also Al- 
ice and Bob) can trust a QKD system when they do not 
necessarily trust the manufacturer of the system ^| . 
Of course, this is not a problem if Alice and Bob use only 
QKD systems that they have made themselves. However, 
this is often impractical. If Alice and Bob conclude that 
the QKD system provided by a manufacturer cannot be 
trusted, the next problem is to determine how they can 
test the QKD system as simply as possible. A basic in- 
gredient for security of the E91 protocol is the principle 
that an eavesdropper (Eve) cannot emulate true entan- 
gled pairs of qubits by any local means, or more specif- 
ically that Eve cannot violate Bell's inequality by any 
separable states. One may think that this principle will 
hold whatever detectors are used by Alice and Bob, in- 
cluding those provided by the manufacturer, as long as 
the detectors give a result that violates Bell's inequality. 
If this is the case, then the E91 protocol has an important 
advantage over other QKD protocols: Alice and Bob do 
not have to test detectors carefully. However, the princi- 
ple can be violated apparently by a detection-loophole if 
non-detection events are not taken into account, as said 
above. Indeed, as shown by Larsson Eli Eve can utilize 
the detection-loophole in eavesdropping: A manufacturer 
who is a friend of Eve designs a QKD system such that 
non-detection events are ignored. If Alice and Bob use 
the system provided by the manufacturer, then Eve can 
violate Bell's inequality apparently. In this case, how- 
ever, if Alice and Bob do not ignore non-detection events 
then Eve can still be caught. 



In this paper we strengthen the result of Ref. [To| . 
If the manufacturer modifies the QKD system appropri- 
ately, Eve can successfully eavesdrop even when Alice and 
Bob take into account non-detection events. A loophole 
utilized here is that of 'free-choice' or 'real randomness' 

(e.g. mill El El El). 

This paper is organized as follows. We introduce the 
E91 protocol, briefly describe Larsson's work, introduce 
the loophole of free-choice and then show how the pseudo- 
random sequence can be utilized by Eve to violate Bell's 
inequality by local means. Finally, we briefl y d iscuss a 
debate on Bell's inequality violation [3 El 111 El El 
and conclude. 

In the E91 protocol, first Alice and Bob distribute n 
pairs of qubits in a Bell state |* _ ) = (I / *J2)(\Q) A \l) B - 
|1)a|0)b). Here n is a positive integer, |0) and |1) are nor- 
malized and orthogonal states, and A and B denote Alice 
and Bob. (The protocol here is a modified version of the 
original E91 protocol with the essence unchanged.) For 
each instance i = 1, 2, ...n, each user randomly and inde- 
pendently chooses to perform either normal measurement 
or checking measurement. Later, the only cases used are 
those where Alice and Bob's measurements match, while 
the other cases are discarded. Among the matched cases, 
those where both Alice and Bob choose a normal mea- 
surement is the normal phase, while the other case is the 
checking phase. In normal the phase, each user performs 
S(z) measurements with a set of basis {|0), |1)}. The out- 
comes of S z measurements are perfectly correlated and 
thus used as a key later. In the checking phase, each user 
performs those measurements suitable for Bell's inequal- 
ity violation of the state |*~): Alice (Bob) randomly 
and independently chooses one between the two direc- 
tions a and a' (b and b') for measurements. Then Alice 
(Bob) performs spin-measurements in the chosen direc- 
tion. Spin-measurement in direction p (q) is denoted as 
S(p) (S(q)) where p = a, a' (q — b,b'). The probabil- 
ity that Alice gets a result ±1 in spin-measurement S(p) 
and Bob gets a result ±1 in spin- measurement S(q) is 
denoted as P±±(p, q). The correlation function E(p, q) is 
given by E(p,q) = P ++ (p,q) + P (v,q) - P+-(p,q) - 
P- + (p,q). Bell's inequality H H is then given by 
\E(a,b) + E(a,b') + E(a',b) - E(a',b')\ < 2. Here the 
four directions, a. a! . b, and b' are chosen such that Bell's 
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inequality is violated for the state \^~). 

The idea of the E91 protocol can be summarized as 
follows. If Eve provides separable states to Alice and 
Bob, then Eve can get information on the key. However, 
in this case the separable states cannot violate Bell's in- 
equality in the checking phase. Thus Eve is detected. For 
example, let us assume that Eve provides either |0)|1) or 
|1)|0) with equal probability after recording which state 
she sends at each instance. In the normal phase noth- 
ing unexpected happens here. In the checking phase, 
however, the samples cannot violate Bell's inequality and 
thus the attack by Eve is detected. On the contrary, if 
Eve provides the legitimate Bell state then Eve can pass 
the checking phase. However, in this case Eve has no 
information on the key generated at Alice's and Bob's 
sites. If Eve provides a partially entangled state, then 
she will get partial information on the key. 

Let us consider Larrson's point E3- Classical infor- 
mation can be encoded on the timing of pulses carry- 
ing qubits. The manufacturer designs the QKD system 
such that the system can read out and make use of the 
classical information thus encoded. Here apparently the 
system works normally for Alice and Bob. Assume that 
a hidden variable A is encoded in the classical informa- 
tion part and that the system is programmed such that it 
violates Bell's inequality by making use of the detection- 
loophole. Then Alice and Bob will observe the system 
violating Bell's inequality in the checking phase. Thus 
Eve is not detected. 

However, we now describe another interesting case, 
termed 'the free-choice loophole' [l2L Il3l IbH HM 161: The 
existence of real randomness is a necessary condition to 
derive Bell's inequality. First, let us recall the locality 
condition for Bell's inequality. Let Sa(p) (Sb(q)) be an 
outcome of spin-measurement in p (q) direction at Alice's 
(Bob's) site. Then a potential candidate is 

Sa(p) = f{p,q,X), S B {q) = g(p,q,X), (1) 

where / and g are normal functions. In Eq. Q), the pos- 
sibility that measurement outcomes at one site depend on 
those at the other site is not excluded. The reason why 
the model in Eq. is usually excluded is that if two 
events are space-like separated, then Alice's device has 
no way of obtaining information on the choice of Bob's 
device on spin-measurement direction y at the instance 
when the spin-measurement is performed, and vice versa. 
Therefore, the measurement outcomes of Alice (Bob) do 
not depend on those of Bob (Alice). That is, Eq. Q 
reduces to 

S A (p) = f(p,X), S B (q)=g(q,X), (2) 

which is the locality condition. However, there is an im- 
portant tacit assumption in the reduction from Eq. 
to Eq. © [H [H [H [H E3: The choice of Bob's de- 
vice on spin-measurement direction q is random so that 
Alice's device cannot predict which one Bob's device will 
choose at a certain instance, and vice versa. Otherwise, 



even if the two measurement events are space-like sepa- 
rated, Alice's device can calculate which direction Bob's 
device will choose, and vice versa. Thus, effectively, Al- 
ice's (Bob's) device has information on which direction 
Bob's (Alice's) device chooses at the instance when they 
are performing the measurement. Hence in this case the 
reduction is not valid in general. 

Let us now see how Eve can utilize the free-choice 
loophole in the E91 protocol: The manufacturer de- 
signs a QKD system such that each device chooses spin- 
measurement directions according to a pseudo-random 
sequence that is installed in the device beforehand. Here 
the pseudo-random sequences in the two devices are in- 
dependent. The pseudo-random sequence is one that ap- 
pears to be random but actually is not. For example, the 
sequence 9869604401089... is apparently random but it 
is obtained from it 2 . The QKD system is also designed 
such that one device contains an algorithm for gener- 
ating the pseudo-random sequence of the other device. 
Thus, effectively, one device has information about the 
choices on spin-measurement direction of the other de- 
vice. Therefore, the locality condition in Eq. J5J) can be 
effectively violated in the QKD system provided by the 
manufacturer. In this case, users, after careful inspec- 
tions, will become aware of a problem in the devices and 
that the measurement choices claimed to be random are 
not really random, of course. However, it is impractical 
for many users to perform such a careful inspection, and 
moreover it is a very difficult task to identify a pseudo- 
random sequence. In other respects, the design of the 
devices is in line with that of Larrson's: In that the hid- 
den variable A is encoded on the timing of the pulses 
carrying qubits. The devices can read out and make use 
of the classical information thus encoded. Therefore, Eve 
can successfully eavesdrop by adopting an effectively non- 
local hidden variable model that simulates the Bell state 
I* - ). Note that here we are dealing with an effectively 
non-local hidden variable model that can simulate any 
entangled state. 

Now, let us briefly discuss a debate on Bell's inequality 
violation El El El El 13 . It is clear that the above 
QKD devices that are intrinsically local can show non- 
local behaviors apparently and effectively. This kinds of 
'local-but-apparently-nonlocal' models have already been 
discussed by several authors, e.g. Bell E2 an d Kwiat et 
al Ell- Recently, Hess and Philipp claimed to present 
a local model that violates Bell's inequality |14l Il5l Il6|. 
However, their model is in the same as the 'local-but- 
apparently-nonlocal' models. It is a fact that purely local 
(deterministic) models without any randomness feeded 
outside can violate Bell's inequality. However, a big 
problem is whether the applicable scope of the 'local-but- 
apparently-nonlocal' models can be extended to macro- 
scopic beings that can generate randomness, e.g. hu- 
mans. This rather philosophical question is beyond scope 
of this paper. 

In conclusion, at first glance the E91 protocol can be 
secure even if Alice and Bob use any QKD system, as 
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long as the system gives a result that violates Bell's in- 
equality. However, as shown by Larrson, this is not the 
case if they ignore non-detection events because Eve can 
use detection-loophole. We showed that Eve can suc- 
cessfully eavesdrop, even when Alice and Bob take into 
account non-detection events, if the manufacturer has de- 
signed the QKD system appropriately. A loophole uti- 



lized here is that of free-choice. We showed how a local 
QKD devices with a pseudo-random sequence generator 
installed in them can apparently violate Bell's inequality. 
We briefly discussed a debate on Bell's inequality viola- 
tion that is involved with a question on randomness. 

I thank G. Weihs for helpful discussions. 
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